Log inSign up
Image
user avatar
Curated Intelligence
@CuratedIntel
Bringing together intelligence researchers and incident responders. #TrackThePlanet
curatedintel.org
Joined September 2020
104
Following
14K
Followers
RepliesMedia
  • user avatar
    Curated Intelligence
    @CuratedIntel
    Jan 31, 2025
    ⚠️PSA: VPN & RDWeb password guessing attacks have been observed originating from IP addresses consistently across the following subnets: 85.239.59.0/24 85.239.58.0/24 85.239.57.0/24 85.239.56.0/24 ➡️ Check for low & slow password guessing attempts and successful logins.
  • user avatar
    Curated Intelligence
    @CuratedIntel
    Jan 31, 2025
    ⚠️PSA: Curated Intel members in DFIR have noticed a trend in exploitation of CVE-2024-57727 in the SimpleHelp RMM tool to deploy Medusa ransomware. ➡️ This tool is often used by IT Managed Service Providers (MSPs) to remotely control customer endpoints and have been impacted.
  • user avatar
    Curated Intelligence
    @CuratedIntel
    Aug 20, 2024
    ⚠️PSA: Curated Intel DFIR has noticed a new trend among Akira Ransomware cases in Summer 2024. For a while, Akira has been exploiting Cisco ASA devices. ➡️ They are now targeting SonicWall SSL-VPNs for access with no MFA (!) and weak passwords (!). Other TTPs remain the same 🔍
  • user avatar
    Curated Intelligence
    @CuratedIntel
    Jan 29, 2024
    ⚠️PSA: Curated Intel DFIR teams noticed a severe uptick in Akira Ransomware cases in Jan 2024. Same repeated TTPs: - Dwell times of < 4 hours on average - Cisco ASA VPN for Access - WinSCP for exfil / WinRAR for compression - AnyDesk RMM for persistence - 'w.exe' Akira payload